[Bro] A few questions

Justin Azoff JAzoff at uamail.albany.edu
Wed Feb 3 10:44:34 PST 2010

On Wed, Feb 03, 2010 at 09:06:42AM -0800, Robin Sommer wrote:
> > core(I have 8) to split up the traffic.  If it took any more I would just get
> > the better intel GigE card and do the traffic splitting in hardware.
> I know that the Intels are able to do that but I'm curious how
> actually set it up. Have you played that with? We're just getting
> some of Intel's 10G models ...
> Robin

I haven't played with it myself.. I thought the last box I got was going to
come with the newer igb cards, but it has an older e1000 based one.

There is a lot of information on it here:


I'm not sure if his patches are required to make it work, or just work faster..

the key bit seems to be:

# insmod ./<driver name>.ko IntMode=3 (IntMode=3 enables MSI-X) 

"It's now time to start your multiqueue PF_RING application. Suppose you use
ethX with Y RX queues: you can either capture from ethX (aggregated traffic
from all RX queues) or from the single queues ethX at 0 ... ethX at Y-1. This means
that if you capture from the ethX device you capture from all queues (PF_RING
merges traffic from all incoming queues). Instead for maximum performance you
can create a multithreaded application which captures from the single queues."

-- Justin Azoff
-- Security & Network Performance Analyst

More information about the Bro mailing list